Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
09-07-2024 05:27
General
-
Target
2f22043d6b0d52119ecdf1f845767d7a_JaffaCakes118.exe
-
Size
153KB
-
MD5
2f22043d6b0d52119ecdf1f845767d7a
-
SHA1
86ac460ac78b4adffea5d46fba40091f16825418
-
SHA256
49d93e4b21fe4e5f552b08cc722d93fb1ca1f2e3b9c6834ee412424026d94a87
-
SHA512
ede5ec5c21fb1cf1d19b529d9edf39773e28cf517b6e74782750ed17f625718489a3797b0f4722ea86d0b40ed76aafe36931102405f669662fc741a26060489d
-
SSDEEP
3072:L0I5+JNTKhn6s5Yv4BAalyeMV4PMAkZz3JQf1CkNE66hc5Jeqovhe:QJJNCev4BLyeq5z5fkuXcJeqoQ
Malware Config
Signatures
-
Gh0st RAT payload 7 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f22043d6b0d52119ecdf1f845767d7a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2f22043d6b0d52119ecdf1f845767d7a_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 4322⤵
- Program crash
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1692 -ip 16921⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
122KB
MD5507a5229363d13c8f4f6361cf4d135fe
SHA16bd05a3d4dc024e2d61bb82c2368b0360d1e6565
SHA256692a09cc6008cb51cb43831227bdaea7c4b4ab67f9dbbad5a6325f0edb780e3b
SHA512da63e5919c0e7561854aaf4c4791e8fbdebd439e6e09aee5237d8d8bed248579b66c957d06839ebdead6efee48c2d4a40845e9b09acdc20381c7bd4cd7035658
-
Filesize
99B
MD5fc336aaaac07ad0ef962e8ab036b9693
SHA17e251cd1c4a7ae8976e2b1a58d5c9dc196c9c79d
SHA2560cbc54c2f7d13453608e64a4c48977d944213fed981740cac072fc664ce16735
SHA512e07a2a5e14d26532e3ba321d8fca3fa3c57c6f9b2298b834bb181a00e28e58fd68266e854a1a97b3aed236d03a10a193f6ab06db26e38b133970eee823d782c5
-
Filesize
14.8MB
MD53062f7dedeb9602fe78b0090b338f097
SHA13f7c071689189f643b43b8f77db2c105470e3d81
SHA2566fb058c7f8e80f21edabb5a8366f662b7f8ca0e527628b088ca835e995525f03
SHA512d116556833b1bb343c06a0adc88759d7d3f24fd2fa021faa66acb8eb9b8b80e0f4b406ad4ac08af457dc25e68714cad4aa65205139358cff676205d1c61f3713
-
Filesize
132KB
-
Filesize
157KB
-
Filesize
132KB
-
Filesize
157KB
-
Filesize
132KB
